Monitor User Commands: 


Following are the basic user monitor commands 


e who 

e last 

e w 

e id 
who 


As a Linux user, sometimes it is required to know some basic information like : 


e Time of last system boot 
e List of users logged-in 
e Current run level etc 


Though this type of information can be obtained from various files in the Linux system but there 
is acommand line utility 'who' that does exactly the same for you. In this article, we will discuss 


the capabilities and features provided by the 'who' command. 


The basic syntax of the who command is : 


Examples of 'who' command 


1. Get the information on currently logged in users 


This is done by simply running the 'who' command (without any options). Consider the 
following example: 


2. Get the time of last system boot 


The is done using the -b option. Consider the following example: 


So we see that the above output gives the exact date and time of last system boot. 


3. Get information on system login processes 


This is done using the -l option. Consider the following example: 


So we see that information related to system login processes was displayed in the output. 


4. Get the hostname and user associated with stdin 


This is done using the -m option. Consider the following example: 


So we see that the relevant information was produced in the output. 


5. Get the current run level 


This is done using the -r option. Consider the following example: 


So we see that the information related to current run level (which is 2) was produced in the 
output. 


6. Get the list of user logged in 


This is done using the -u option. Consider the following example: 


So we see that a list of logged-in users was produced in the output. 


7. Get number of users logged-in and their user names 


This is done using the -q option. Consider the following example: 


So we see that information related to number of logged-in users and their user names was 
produced in the output. 


8. Get all the information 


This is done using the -a option. Consider the following example: 


So we see that all the information that 'who' can print is produced in output. 


last command: 


To find out when a particular user last logged in to the Linux or Unix server. 


Syntax 


The basic syntax is: 


last 

last [userNameHere] 

last [tty] 

last [options] [userNameHere] 


If no options provided last command displays a list of all users logged in (and out). You can 


filter out results by supplying names of users or terminal to show only those entries matching the 
username/tty. 


last command examples 


To find out who has recently logged in and out on your server, type: 
$ last 


Sample outputs: 


root pts/1 10.1.6.120 Tue Jan 28 05:59 still logged in 
root pts/0 1Os.1.362,.120 Tue Jan 28 04:08 still logged in 
root pts/0 10.1.6.120 Sat Jan 25 06:33 - 08:55 (02:22) 
root pts/1 10.1.6.120 Thu Jan 23 14:47 - 14:51 (00:03) 
root pts/0 10 <1. 6120 Thu Jan 23 13:02 - 14:51 (01:48) 


root pts/0 10...1..6.120 Tue Jan 7 12:02 - 12:38 (00:35) 


wtmp begins Tue Jan 7 12:02:54 2014 


List all users last logged in/out time 


last command searches back through the file /var/log/wtmp file and the output may go back to 
several months. Just use the less command or more command as follows to display output one 
screen at a time: 


S last | more 
last less 


List a particular user last logged in 


To find out when user iafzal last logged in, type: 
$ last iafzal 

$ last iafzal | less 

$ last iafzal | grep 'Thu Jan 23' 


Sample outputs: 


EF iafzal@MyFirstLinuxO 


Hide hostnames (Linux only) 


To hide the display of the hostname field pass -R option: 
$ last -R 
last -R iafzal 


Sample outputs: 


iafzal@MyFirstLinuxOS:~ 
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Display complete login & logout times 


By default year is now displayed by last command. You can force last command to display full 


login and logout times and dates by passing -F option: 
$ last -F 


Sample outputs: 


æ iafzal@MyFirstLinuxOS:~ 
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Display full user/domain names 
$ last -w 
Display last reboot time 


The user reboot logs in each time the system is rebooted. Thus following command will show a 


log of all reboots since the log file was created: 
$ last reboot 
$ last -x reboot 


Display last shutdown time 


Find out the system shutdown entries and run level changes: 
$ last -x 
$ last -x shutdown 


Find out who was logged in at a particular time 


The syntax is as follows to see the state of logins as of the specified time: 
$ last -t YYYYMMDDHHMMSS 
$ last -t YYYYMMDDHHMMSS userNameHere 


w command: 


Options: 

-h, --no-header do not print header 

-u, --no-current ignore current process username 

-s, --short short format 

-f, --from show remote hostname field 

-o, --old-style old style output 

=i; --ip-addr display IP address instead of hostname (if possible) 

--help display this help and exit 
-V, --version output version information and exit 


id command: 
Print user and group information for the specified USER, 
or (when USER omitted) for the current user. 


-a ignore, for compatibility with other versions 


-Z, --context print only the security context of the current user 
-g, --group print only the effective group ID 
-G, --groups print all group IDs 
-n, --name print a name instead of a number, for -ugG 
-r, --real print the real ID instead of the effective ID, with -ugG 
-u, --user print only th ffective user ID 
=Z; --zero delimit entries with NUL characters, not whitespace; 
not permitted in default format 
--help display this help and exit 
--version output version information and exit 


